*.lisp: Add CAA records to discourage wrong CAs from issuing.

[zones] / escorted.lisp

diff --git a/escorted.lisp b/escorted.lisp
index ab5c5b3..e2f542d 100644 (file)
--- a/escorted.lisp
+++ b/escorted.lisp
@@ -20,6 +20,10 @@
   ;; Web service.
   ((@ www) :svc stratocaster)
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Mail servers
   :mx ((mail :ip stratocaster))
   :srv ((:smtp mail))